Resumen APTTrail
APTTrail mantiene indicadores publicos asociados a oldgremlin. Aliases observados: oldgremlin, tinyfluff. Conteo por tipo: domain: 26, ipv4: 2, url: 11.
Indicadores de Compromiso (IOCs)
| Tipo | Valor | Contexto |
|---|---|---|
| Domain | a3c65c.org | APTTrail |
| Domain | broken-poetry-de86.nscimupf.workers.dev | APTTrail |
| Domain | calm-night-6067.bhrcaoqf.workers.dev | APTTrail |
| Domain | ccdn.microsoftdocs.workers.dev | APTTrail |
| Domain | curly-sound-d93e.ygrhxogxiogc.workers.dev | APTTrail |
| Domain | eccbc8.com | APTTrail |
| Domain | hello.tyvbxdobr0.workers.dev | APTTrail |
| Domain | ksdkpwpfrtyvbxdobr1.tiyvbxdobr1.workers.dev | APTTrail |
| Domain | ksdkpwprtyvbxdobr0.tyvbxdobr0.workers.dev | APTTrail |
| Domain | late-salad-2839.yriqwzjskbbg.workers.dev | APTTrail |
| Domain | mirfinance.org | APTTrail |
| Domain | noisy-cell-7d07.poecdjusb.workers.dev | APTTrail |
| Domain | ns1.a3c65c.org | APTTrail |
| Domain | ns1.eccbc8.com | APTTrail |
| Domain | ns2.a3c65c.org | APTTrail |
| Domain | ns2.eccbc8.com | APTTrail |
| Domain | ns3.a3c65c.org | APTTrail |
| Domain | ns3.eccbc8.com | APTTrail |
| Domain | ns4.a3c65c.org | APTTrail |
| Domain | ns4.eccbc8.com | APTTrail |
| Domain | odd-thunder-c853.tkbizulvc.workers.dev | APTTrail |
| Domain | old-mud-23cb.tkbizulvc.workers.dev | APTTrail |
| Domain | rbcholding.press | APTTrail |
| Domain | rough-grass-45e9.poecdjusb.workers.dev | APTTrail |
| Domain | wispy-fire-1da3.nscimupf.workers.dev | APTTrail |
| Domain | wispy-surf-fabd.bhrcaoqf.workers.dev | APTTrail |
| IP | 161.35.41.9:53:53 | APTTrail |
| IP | 46.101.113.161:53 | APTTrail |
| URL | http://136.244.67.59 | APTTrail |
| URL | http://159.65.198.79 | APTTrail |
Referencias
- https://app.any.run/tasks/f21e3a4f-b734-4285-96b4-d2f274e19413/
- https://blog.group-ib.com/oldgremlin_comeback
- https://otx.alienvault.com/pulse/5f6ccbe362057a239425fc18
- https://rt-solar.ru/events/news/1915/ (Russian)
- https://twitter.com/ShadowChasing1/status/1293834710703996928
- https://twitter.com/ShadowChasing1/status/1552595370961944576
- https://twitter.com/ShadowChasing1/status/1562242596789170177
- https://twitter.com/ShadowChasing1/status/1566699481768542208
- https://twitter.com/Vishnyak0v/status/1296696059264196608
- https://twitter.com/_re_fox/status/1301143311391109120
- https://twitter.com/k3yp0d/status/1552619518777868288
- https://www.group-ib.com/blog/oldgremlin